Medical Design and Outsourcing

  • Home
  • Medical Device Business
    • Mergers & Acquisitions
    • Financial
    • Regulatory
  • Applications
    • Cardiovascular
    • Devices
    • Imaging
    • Implantables
    • Medical Equipment
    • Orthopedic
    • Surgical
  • Technologies
    • Supplies and Components Index
    • Contract Manufacturing
    • Components
    • Electronics
    • Extrusions
    • Materials
    • Motion Control
    • Prototyping
    • Pumps
    • Tubing
  • MedTech Resources
    • Medtech Events in 2025
    • The 2024 Medtech Big 100
    • Medical Device Handbook
    • MedTech 100 Index
    • Subscribe to Print Magazine
    • DeviceTalks
    • Digital Editions
    • eBooks
    • Educational Assets
    • Manufacturer Search
    • Podcasts
    • Print Subscription
    • Webinars / Digital Events
    • Whitepapers
    • Voices
    • Video
  • 2025 Leadership
    • 2024 Winners
    • 2023 Winners
    • 2022 Winners
    • 2021 Winners
  • Women in Medtech
  • Advertise
  • Subscribe

Medical device cybersecurity: Here’s how you verify and validate it

November 8, 2017 By Danielle Kirsh

cybersecurityCybersecurity is becoming an essential pillar of medical device design, and it’s important to find the right strategies to validate and verify your products are secure.

Michael Lynch and Delmar Howard, Intertek

The growth of connected environments has put medical devices at the forefront of the cybersecurity and patient data movement. As more of these devices are brought online there is an increased risk of hackers looking for targets that have, in the past, had a very lax standard for security. As shown by several high-profile exploits, the industry appears to still be catching up when addressing security concerns.

Fortunately, there are many industry guidance documents available, but sorting through them and identifying the most effective can be daunting. Almost all directives from the FDA concerning cybersecurity are nonbinding, which can make it difficult to confidently identify the most effective way to implement a verification and validation process. The exception is the premarket submission process, which requires documentation on how cybersecurity is implemented.

For many device manufacturers, the difficulty is not only in identifying standards to follow but which apply to their specific product. Ensuring the chosen framework can scale as the device is updated and changed is also a challenge. Updates – or a lack thereof – can be challenging because of the possibility of introducing new vulnerabilities. Cybersecurity is rarely a rigid checklist that applies to all industries. In many cases, third-party help is required given the large number of complementary guidance documents available.

NIST Framework

One of the most comprehensive guidance documents available is the Framework for Improving Critical Infrastructure Cybersecurity published by the National Institute of Standards and Technology (NIST). This is one of the most effective documents to lay the groundwork for cybersecurity implementation. The “Identify, Protect, Detect, Response & Recover” framework core is referenced throughout the industry and allows device manufacturers to consistently identify gaps in their processes through risk-based implementation.

Utilizing an Information Sharing & Analysis Organization (ISAO) can help gather and identify industry threats and can be an effective solution for keeping a baseline of security throughout the design and post-market cycle by leveraging the overall knowledge of the group. Participating with an ISAO also helps meet the FDA guidance on postmarket cybersecurity.

Medtech regulations

There are many regulations that medical devices must adhere to. The EU’s General Data Protection Regulation is one of the most stringent, requiring immediate action. Effective May of 2018, the GDPR will change from a directive to a regulation, which is a stronger form a legislation. Some of the key considerations for medical devices are breach notification – in which users must be notified of a breach within 72 hours – and privacy by design, requiring privacy considerations when a product is designed. Both requirements align with generally effective cybersecurity design practices and should be part of the ongoing validation and review process.

In its final premarket guidance, the FDA is now looking for a cybersecurity plan, as well as data to back it up. Specifically, device manufacturers must identify cybersecurity risks, provide a traceability matrix and give a summary of controls created in the design of the device.

Verification & validation

After considering the applicable guidance and regulations for a device, it’s important to conduct verification and validation activities to illustrate security is in place. When running verification and validation on connected medical electrical equipment, it’s important to take a two-prong approach, examining both the software and hardware of a device:

  • Software: Medical device manufacturers spend large amounts of time on hardware development, but software development is less structured. Manufactures should include robust requirements for validation. The adoption of IEC 62304 is a good start to ensure that software validation has equal consideration in the design phase. While IEC 62304 doesn’t identify specific tools to use; it provides a robust framework for verification and validation throughout the software development process.
    Ongoing cybersecurity risk assessments and static analysis are key ways to help mitigate zero-day-style exploits on hardware and software. This is especially important within environments using Software of Unknown Provenance (SOUP). When devices enter a hospital environment, they can be placed somewhere not specifically intended for them to operate. Testing within a mixed interoperability environment can help mitigate some of these issues by better understanding various connections and network features common in a real-world environment.
    For example, Intertek has created virtual offices that include several hundred unique devices that can emulate a live hospital environment. With large-scale emulated environments, it is easier to test patches and identify potential limitations without subjecting customers and patients to potential harm.
  • Hardware: Addressing hardware security during the design & development phase goes well beyond simply testing and validating. Hardware has the disadvantage of not being able to be updated easily once delivered to a customer. To combat this, it’s essential to avoid activating ports that are not required to function and ensuring each piece of hardware has a unique ID and login implementation.
    Additionally, it’s critical to make sure features not in use are either disabled or removed from the device, prior to it being introduced to a live environment, especially when outsourcing. Some hardware chips can be activated using physical access and, in rare cases, can be activated through software.
    The UL-2900 standards are a good starting point; however meeting all of the requirements requires already having an effective documentation and validation process; it’s a good guideline for internal teams to work towards before opening up for a third party audit.

Increased breaches revealing personally identifiable information have made designing security into medical devices and their accompanying software required for all 510k submissions to the FDA in the US and through regulations such as GDPR in the EU. Having an effective validation and verification plan during the design phase has been a requirement for bringing medical devices to the market for twenty years. Adding cybersecurity to that plan is essential for any connected device.

Michael Lynch is managing consultant and Delmar Howard is performance testing program manager at Intertek (London).

 

About The Author

Danielle Kirsh

Danielle Kirsh is an award-winning journalist and senior editor for Medical Design & Outsourcing, MassDevice, and Medical Tubing + Extrusion, and the founder of Women in Medtech and lead editor for Big 100. She received her bachelor's degree in broadcast journalism and mass communication from Norfolk State University and is pursuing her master's in global strategic communications at the University of Florida. You can connect with her on Twitter and LinkedIn, or email her at dkirsh@wtwhmedia.com.

Related Articles Read More >

An image of an infusion pump.
Cybersecurity report flags device vulnerabilities and user needs
3 surprising cybersecurity risks in medical device software
Johnson & Johnson discloses executive pay and new security measures
A photo of CMR Surgical's Versius Surgical System being used during a simulation of a cholecystectomy.
A surgical robotics co-founder offers lessons from the de novo pathway
“mdo
EXPAND YOUR KNOWLEDGE AND STAY CONNECTED
Get the latest medical device business news, application and technology trends.

DeviceTalks Weekly

See More >

MDO Digital Edition

Digital Edition

Subscribe to Medical Design & Outsourcing. Bookmark, share and interact with the leading medical design engineering magazine today.

MEDTECH 100 INDEX

Medtech 100 logo
Market Summary > Current Price
The MedTech 100 is a financial index calculated using the BIG100 companies covered in Medical Design and Outsourcing.
DeviceTalks

DeviceTalks is a conversation among medical technology leaders. It's events, podcasts, webinars and one-on-one exchanges of ideas & insights.

DeviceTalks

New MedTech Resource

Medical Tubing

MassDevice

Mass Device

The Medical Device Business Journal. MassDevice is the leading medical device news business journal telling the stories of the devices that save lives.

Visit Website
MDO ad
Medical Design and Outsourcing
  • MassDevice
  • DeviceTalks
  • MedTech100 Index
  • Medical Tubing + Extrusion
  • Medical Design Sourcing
  • Drug Delivery Business News
  • Drug Discovery & Development
  • Pharmaceutical Processing World
  • R&D World
  • About Us/Contact
  • Advertise With Us
  • Subscribe to Print Magazine
  • Subscribe to our E-Newsletter
  • Listen to our Weekly Podcasts
  • Join our DeviceTalks Tuesdays Discussion

Copyright © 2025 WTWH Media, LLC. All Rights Reserved. The material on this site may not be reproduced, distributed, transmitted, cached or otherwise used, except with the prior written permission of WTWH Media LLC. Site Map | Privacy Policy | RSS

Search Medical Design & Outsourcing

  • Home
  • Medical Device Business
    • Mergers & Acquisitions
    • Financial
    • Regulatory
  • Applications
    • Cardiovascular
    • Devices
    • Imaging
    • Implantables
    • Medical Equipment
    • Orthopedic
    • Surgical
  • Technologies
    • Supplies and Components Index
    • Contract Manufacturing
    • Components
    • Electronics
    • Extrusions
    • Materials
    • Motion Control
    • Prototyping
    • Pumps
    • Tubing
  • MedTech Resources
    • Medtech Events in 2025
    • The 2024 Medtech Big 100
    • Medical Device Handbook
    • MedTech 100 Index
    • Subscribe to Print Magazine
    • DeviceTalks
    • Digital Editions
    • eBooks
    • Educational Assets
    • Manufacturer Search
    • Podcasts
    • Print Subscription
    • Webinars / Digital Events
    • Whitepapers
    • Voices
    • Video
  • 2025 Leadership
    • 2024 Winners
    • 2023 Winners
    • 2022 Winners
    • 2021 Winners
  • Women in Medtech
  • Advertise
  • Subscribe